‘ABANCA: unauthorised access has been detected on your account. Verify your identity to avoid a block’, and right below it a link. It arrives on a Saturday afternoon, with the branch closed, and it often turns up in the very thread where the bank sends you genuine alerts about your direct debits. Your pulse quickens and your finger drifts towards the link of its own accord. Stop right there: that message was not sent by Abanca. It is a criminal posing as your bank.
It is called smishing, the text-message version of the old phishing trick. This is neither a minor nor a marginal problem: according to Spain’s Ministry of the Interior, almost nine out of ten cybercrimes committed in Spain are computer fraud —412,850 scams in 2024, 89% of the total—, and impersonating banks is one of the favourite levers of those behind it.
How to spot the fake text
The script repeats with small variations. The message invents an urgency and puts a link in front of you to ‘sort it out’ on the spot:
- A charge you do not recognise: ‘A charge of EUR 105.00 has been made on your account. If you do not recognise it, cancel it here.’
- A login from a new device that you are asked to ‘verify immediately’.
- An account or card that is ‘blocked’ and can only be ‘unblocked’ by tapping the link.
The most reliable clue is in that link. It does not take you to abanca.com, but to a domain that looks like it and isn’t: something along the lines of es-abanca-dispositivo.com/app. That is where the fraud lives. Always look at what comes just before the last dot: it has to be exactly abanca.com and nothing else.
Why it looks so real
Because it is designed to. The sender’s name can show up as ‘ABANCA’, and through spoofing the message can slip into the very conversation thread where you keep the bank’s legitimate alerts, so you drop your guard. If you tap, the fake site clones the online-banking login screen and asks you, in order, for your ID number, your password, the phone linked to the account and the code you have just received by text. While you stare at a screen that keeps ‘loading’, on the other side they are already using your details. Sometimes it is finished off with a call from a supposed ‘security department’ that hurries you into confirming a code or moving your money to a ‘safe account’. That pressure —the fear of losing your money right now— is the tool, not a slip.
What Abanca never does
This is the part worth committing to memory, because it separates the genuine from the fake with no room for doubt. The bank’s official position, set out on its own security page and confirmed by INCIBE and by Maldita.es, is blunt: ‘We will never ask you for your login details.’ Specifically, Abanca never:
- Asks you by text, phone or email for your login details, your PIN, your card number or CVV, or the verification codes (OTP) sent to your mobile.
- Sends you a link to ‘verify’, ‘unblock’ or ‘confirm’ your account.
- Asks you to move or transfer your money to another account ‘to protect it’, or to install apps by following instructions over the phone.
Real authentication happens inside the official app —the one you download only from the App Store or Google Play— or by typing the address into your browser yourself. Never through a link that arrives in a message. So the rule is simple: if a message claiming to be from Abanca asks you for any of those things, it is not Abanca.
What to do right now
- Do not tap the link and do not type anything into the page it leads to.
- Do not give out your login details, PIN, card details or any code you receive by text, whether by phone or by message.
- If you want to check whether something is really going on with your account, log in only through the official app or by typing
abanca.cominto the browser yourself; never from the link in the text. - When in doubt, hang up and call them yourself: the number on the back of your card or Abanca’s security line (900 815 525, or +34 981 910 525 from abroad). If someone rings you claiming to be from the bank, hang up and call back on the official number.
- If you have only received the text and have not filled anything in, save a screenshot, mark it as spam and delete it. You can also report it to INCIBE on the free line 017 and at
tuseguridad@abanca.com. - If you have already entered your details on the fake page, change your online-banking password as soon as possible, call Abanca’s official number so they can block access and the card, save screenshots of the message and the site, and report it to the Policía Nacional or the Guardia Civil.
If you have already tapped, given your details or made a payment
This is where time matters most. Do not freeze and do not write the money off as lost: every hour that passes counts. The sensible thing is to put yourself in the hands of a solicitor who specialises in cybercrime as soon as possible, to assess your particular case and tell you what steps to take. The sooner you do it, the better.
And if what you are really asking is whether that money can be recovered, in many cases it can. We explain it in does the bank have to give my money back after a phishing scam?.
At the firm we handle exactly this kind of matter through our cybercrime practice; if you would like us to look at what has happened to you, you can write to us from the contact page. And if you want to understand the full picture of these bank impersonations, we have brought it together in our guide to the scam where fraudsters impersonate your bank.
Frequently asked questions
How do I know whether the text is from Abanca or a scam?
By what it asks you for. Abanca does not ask for your login details, your PIN or the codes sent to you by text, and it does not send links to ‘unblock’ or ‘verify’ your account. If the message asks for any of that, hurries you along or includes a link, it is impersonation. Always check by logging in through the official app or by typing abanca.com yourself, never from the link.
The text appears in the same thread as Abanca’s real messages — doesn’t that mean it is genuine?
No. Fraudsters fake the sender’s name and get the message to slip into the thread where you keep the legitimate alerts. Its appearing there guarantees nothing. Look at the content —whether it asks for login details or codes, or sends you to a link— not at the name the sender displays.
I tapped the link but did not enter any details — should I worry?
If you did not go as far as entering your ID number, your password or any code, the risk is much lower. Even so, do not fill anything in on that page, close it and check your account only through the official app. If you are in any doubt, change your online-banking password and call Abanca’s official number.
I have already given my details or made a payment — what do I do?
Do not write it off as lost and do not wait to see what happens: time is against you. Put yourself in the hands of a solicitor who specialises in cybercrime as soon as possible so they can look at your case. You can get in touch with us through the contact page.